# 0. compile xpdf
# 0.1 make & install normal xpdf
CC=afl-gcc CXX=afl-g++ ./configure && make && make install
# 0.2 make xpdf with address sanitizer, this won't be installed into /usr/local/bin
CC=afl-gcc CXX=afl-g++ CFLAGS='-fsanitize=address -fno-omit-frame-pointer' CXXFLAGS='-fsanitize=address -fno-omit-frame-pointer' ./configure && make
# 1. normal
afl-fuzz -i in -o out  -- ../xpdf/pdftotext @@ res/

# 2. parallel
screen -S master
afl-fuzz -i in -o sync -m none -M master -- ../xpdf/pdftotext @@ res/
screen -S slave01
afl-fuzz -i in -o sync -m none -S slave01 -- ../xpdf/pdftotext @@ res/
screen -S slave02
afl-fuzz -i in -o sync -m none -S slave02 -- ../xpdf/pdftotext @@ res/
screen -S slave03
afl-fuzz -i in -o sync -m none -S slave03 -- ../xpdf/pdftotext @@ res/

# 3. rebuild xpdf with debug info
CC=afl-gcc CXX=afl-g++ CFLAGS='-g -O0' CXXFLAGS='-g -O0' ./configure && make

# 4. crash analysis with gdb
cd AFL
gdb --args ../xpdf/pdftotext out/crashes/id:000000,sig:11,src:000002,op:havoc,rep:3

# 5. llvm (faster)
CC=afl-clang-fast CXX=afl-clang-fast++  ./configure && make
afl-fuzz -i in -o out  -- ../xpdf/pdftotext @@ res/

# 6. why not persistent mode or deferred instrumentation? hard to understand source code...

# 7. try afl-tmin after find crashes
# diff between afl-cmin & afl-tmin
# afl-cmin needs to be used before you start the fuzzing to minimize file corpus and afl-tmin needs to be used after you found a crash to reduce its size so that it helps in analysis.
afl-tmin -i out/crashes/id:000000,sig:11,src:000002,op:havoc,rep:32 -o minimized_crash -- ../xpdf/pdftotext @@